feat(power): suspend-then-hibernate 1h on battery (#115)

Human decision: 1h delay, battery only, Preferences enable/disable.
Wire systemd suspend-then-hibernate + HibernateDelaySec=1h +
HibernateOnACPower=false when settings.power.suspendThenHibernate is on
and boot.resumeDevice is set. Lid: s2h undocked, plain suspend on AC.
nomarchy-suspend for hypridle + Power menu (live state). LUKS unlock
before encrypted hibernate so s2h→disk is not double-password.
state-bridges assert the policy; HARDWARE-QUEUE #115 + suggested order.

V1: nix flake check --no-build. V3: bag-carry on hardware.

modules/home/idle.nix

@@ -22,6 +22,9 @@ let
 in
 {
   config = lib.mkIf cfg.idle.enable {
+    # Smart suspend on PATH for manual use; hypridle uses the store path.
+    home.packages = [ pkgs.nomarchy-suspend ];
+
     programs.hyprlock = {
       enable = true;
       settings = {
@@ -122,10 +125,15 @@ in
           # Suspend only on battery, and sooner than the old fixed 30 min
           # (it now only fires unplugged). Plugged in, the machine stays
           # up — long builds, media, presentations aren't killed mid-idle.
+          # nomarchy-suspend (#115): on battery + hibernate wired + toggle
+          # on → suspend-then-hibernate (1h → disk); else plain suspend.
           # Lid close is logind's job (not hypridle): undocked lid still
-          # suspends (HandleLidSwitch); docked/clamshell lid is ignore
+          # suspends / s2h (HandleLidSwitch); docked/clamshell lid is ignore
           # (HandleLidSwitchDocked — modules/nixos/power.nix, #86).
-          { timeout = 900; on-timeout = "${onAc} || systemctl suspend"; }
+          {
+            timeout = 900;
+            on-timeout = "${onAc} || ${lib.getExe pkgs.nomarchy-suspend}";
+          }
         ];
       };
     };